- How do I install zaber-dev/laravel-cooldown in a Laravel app?
- Install it with Composer using composer require zaber-dev/laravel-cooldown. The package uses standard Laravel package mechanics, so service provider auto-discovery and publishable configuration apply. If you plan to use database storage, publish and run the migrations before enforcing cooldowns in production.
- What is the difference between Laravel Cooldown and Laravel's built-in RateLimiter?
- Laravel's RateLimiter is throughput-oriented: it counts requests per window per key. LaravelCooldown targets persistent, entity-scoped action windows, such as one password reset per user per five minutes or one report export per account per hour. The two are complementary, but be careful about enabling both on the same route because duplicated enforcement can produce confusing 429 and Retry-After behavior.
- Should I use cache or database storage for action cooldowns?
- Use cache storage, such as Redis or Memcached, for ephemeral UX friction like preventing double clicks or spamming a resend button. Use database storage when cooldowns must survive cache flushes, eviction, or Redis maxmemory pressure, or when you need an audit trail. That choice is a product and compliance decision, not just an infrastructure preference.
- Does Laravel Cooldown guarantee atomic check-and-set under concurrent requests?
- The package advertises atomic execution, which matters because cooldown enforcement is a check-then-set problem. Verify per driver that the implementation uses Redis SET NX or a Lua script and a database unique constraint or transaction. Without atomicity, burst traffic can bypass the cooldown, which is exactly the condition cooldowns are meant to prevent.
- How do I protect a route with Laravel Cooldown middleware?
- Attach the package middleware declaratively to the routes or route groups you want to guard. Confirm the response contract it exposes, typically a 429 status with a Retry-After header and a custom message, and document and localize that contract for API consumers. If you also use Laravel's throttle middleware on the same route, test both layers together to avoid contradictory client behavior.
- Can I scope a cooldown to a specific user, model, or tenant?
- Yes. The fluent API keys cooldowns by action name and entity, and you can pass an Eloquent model or user so state is scoped per record. Multi-tenant keying and collision avoidance are largely the caller's responsibility, so include a tenant identifier in the action key or entity scope. Test that two tenants or two users cannot accidentally share a cooldown slot.
- Which Laravel and PHP versions does Laravel Cooldown support?
- The README states support for Laravel 11, 12, and 13+, PHP 8.2+, and Redis, Memcached, or database storage. Before adoption, check the CI matrix in the repository to confirm which PHP, Laravel, and cache-driver combinations are actually exercised. README claims are not evidence, especially for an unproven dependency.
- What happens if the cache or database store is unavailable during a cooldown check?
- This is the fail-open versus fail-closed question, and it matters most in security-adjacent flows like OTP sending or payment retries. Confirm the documented behavior when the backing store is unreachable and whether it can be configured per cooldown. If the package fails open, a Redis outage could silently disable every cooldown in your application.
- Are expired database cooldown records pruned automatically?
- Database-backed cooldowns add write amplification and a pruning obligation over time. Check whether the package ships a scheduled command or queued job for removing expired rows and whether an index supports that cleanup efficiently. If pruning is not automatic, add your own scheduled task before enabling database storage in production.
- Can I extend Laravel Cooldown with a custom storage backend, and is it production-ready?
- The package documents a custom storage contract so you can plug in another backend, but assess how stable and versioned that contract is before building on it. Weigh the adoption signal too: roughly 38 stars, zero dependents, and a single vendor, plus a release date that deserves verification. Pin the version, review the changelog and CI history, and cover your critical cooldown paths with integration tests.